CVE-2022-2119

Deeper analysis

OFFIS DCMTK versions prior to 3.6.7 contain a path traversal vulnerability in the service class provider (SCP) component. The flaw, tracked as CWE-22, permits an attacker to supply crafted DICOM objects that cause files to be written to arbitrary directories with attacker-controlled names, which may in turn enable remote code execution on the affected system. The issue carries a CVSS 3.1 score of 7.5 with an attack vector of adjacent network, high attack complexity, and no required privileges or user interaction.

An unauthenticated attacker positioned on the same network segment as a DCMTK SCP can send malicious DICOM association requests or C-STORE operations to exploit the path traversal. Successful exploitation allows the attacker to place executable content in locations such as startup folders or application directories, achieving code execution under the privileges of the SCP process.

CISA advisory ICSMA-22-174-01 and the Debian LTS announcement recommend upgrading DCMTK to version 3.6.7 or later. The Debian package update addresses the path traversal by enforcing stricter validation of incoming file paths before any write operations occur.

EPSS for this CVE rose from low values at disclosure to a peak of 0.3287 on 2025-01-22 before receding to the current 0.0568, indicating that exploitation interest increased well after the original publication.